VSS Snapshot Warning

[Timothy_Potter]

I have a job that ends every night with a single exception. Here is the message: Backup- \\[COMPUTERNAME]\System?State VSS Snapshot warning. File c:\windows\system32\drivers\dcdbas32.sys is not present on the snapshot.

I searched the message boards and have verified that the file is present. I have deleted the registry key for the PnpLockdownFiles that refers to this driver. Anyone else having this issue with Dell OpenManage Server Administrator v5.5.0 and Windows Server 2008 System State backups?

[Kevin_Cotreau]

This may help, but you should make sure that you have the lastest VSS patch for your system installed on local and remote systems:

http://www.microsoft.com/downloads/details.aspx?FamilyID=ae17b7ef-3c02-496a-bb46-770c04e42b5c&Displa...  (server 2003)

http://www.microsoft.com/downloads/details.aspx?FamilyID=5eb76bda-8794-412a-9fd4-1bccbbc34c82&Displa... (server 2008 x64)

[Timothy_Potter]

Thanks for the suggestions, but both the backup server and the remote server are running Windows Server 2008 32-bit versions, so neither of the VSS updates are applicable. For now, I'm just not going to worry about the error message since I believe the backup is otherwise just fine.

[Symply_Frustrat]

We are having the same issue with the same file. If anyone can offer any insight, it will be appreciated. Thanks!

VSS Snapshot warning. File c:\windows\system32\drivers\dcdbas32.sys is not present on the snapshot

Windows Server 2008 Ent SP1 - Backup Exec 12.5 rev 2213

We do not have Dell Server Administrator installed, but it is a Dell Poweredge 2950 Server that is running the backup exec software, and the error is for the local system state backup.

[tom_sm]

We have the same issue. We run Backup Exec 12.5 on Windows 2008 32 bit.

When I run a full backup I get the following error:

VSS Snapshot warning. File c:\windows\inf\oem1.inf is not present on the snapshot.

Before I had some problem with my tape drive. I removed it from the device list and reinstalled it using tapeinst.exe.

After this the backups ran again, but I get this snapshot warning.

How can I fix this problem? Thank you!

[Kevin_Cotreau]

I was finally able to recreate this problem on a test system. This is being caused by any number of programs installed on Windows 2008 not uninstalling correctly, but the issue may even be in a place called the NT filespace (I have two more Microsoft internal OS databases to look at before I can conclude that), which is not accessible by any normal means. One of the most common offenders is VMWare Server version 1.xx. This is a Windows problem, not a BE problem, and BE is just reporting what Windows is telling it.

I have deleted every file with an internal reference to the reported files, and that does not help.

I am trying to find a solution, but if not, I will post a work-around. After I look at those OS databases, I will also post everything I have done and show where the problem is being created.

I am doing this as my time allows, so it could take a week. The issue is benign though.

[tom_sm]

Kevin,

Thank you for the information. The issue is indeed benign.

It is only annoying to have these warnings.

Thank you.

[Timothy_Potter · Accepted solution]

I wanted to report back, even though the thread is old. I updated the Dell OpenManage Server Administration program to a newer version and the warning disappeared. In my case I'm thinking that something in the original installation was correct and upgrading fixed the issue.

[Kevin_Cotreau]

Tim, that is probably because you just reinstalled the file that the snapshot was looking for, so it now exists. I would bet that if you uninstall the application again, the warning would return.

That masked the warning, but probably is not a solution for anyone who actually wants to remove an application for good, like when this occurs after uninstalling VMWare.

[PaulT780]

Although this thread is a few weeks old and there is already an accepted solution i thought i would post here as i have run into an issue with the same file (c:\windows\system32\drivers\dcdbas32.sys).

I found this support article for a different file but similar issue http://seer.entsupport.symantec.com/docs/304833.htm

The problem i have there is a registry key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles

that points to dcdbas32.sys but the file does not exist in \system32\drivers\

Unlike Timothy I havent installed Dell OpenManage on my server nor do i plan to ever install it and i dont think there is even a 64bit version of it (i may be wrong havent really looked into it). So can i just remove the registry key? or will that cause other issues? Will that even solve the problem?

Thanks

Message Edited by PaulT780 on 02-05-2009 11:18 AM

[Kevin_Cotreau]

Paul, You should be able to remove that key with not problems, but I always suggest that you export it to the desktop first, just in case.

That said, I don't think that will make the error message go away. The error is being caused wherever the backup list of files is being created from the snapshot, and although I have not had time lately, I can't find where that is. It is not in the registry or in any file. I suspect it may be in the Windows namespace somewhere.

The workaround is to actually put a copy of the file in that directory. You could even create a blank text file and rename it to whatever the file your backup is reporting.

[PaulT780]

Thanks for getting back to me, i created the missing file as you suggested and also did the same on another server that is having the same issue (but different file). I will just wait for the backup to run tomorrow to see what happens.

Also thanks for clarifying that the registry is not the list which is why i thought deleting the registry entry would fix it. It would be nice to know where that list actually is and if it is possible to clean it up.

I dont know if this helps in any way but the issue started when i upgraded from backup exec 11 to 12.5.

Message Edited by PaulT780 on 02-05-2009 01:27 PM

[CoastalRange]

I find it interesting this thread is marked as solved, although I don't see a definitive solution here.

Anyway, I have the same problem, Server 2008 x64, which WAS hosting an MS Virtual Server instance (Had to put the Management console for SEP somewhere until MR4 came out which properly supports Server 2008.) Now it's gone and I have 6 VSS warnings, three of which are VM server driver files. I'm also getting a VSS initialization failure. Interestingly, when I backup the server by itself, as I am now, the job finishes with exceptions, but if I include it in the all server backup job the job gets marked as failed. A Windows Server backup of the machine completes 100%, no problems.

An actual resolution for this would be nice, even if it IS an MS generated problem.

[tom_sm]

Indeed, this thread is not solved.

My problem was that the file oem1.inf was missing. So as a workaround I created an empty text file and named it oem1.inf. Now the backup completes successfully.

But I never got a VSS initialization failure, just a VSS warning that files were missing.

I hope someone will find a solution for this problem....

[CoastalRange]

Well I thought I would report back.

The non-existant files were:

C:\windows\inf\oem1.inf

c:\windows\inf\oem2.inf

c:\progam files (x86)\symantec\symantec endpoint pprotection\smclu\setup\smcinst.exe

c:\windows\system32\drivers\vhdbus.sys

c:\windows\system32\vhdstorlog.dll

c:\windows\system32\drivers\vhdstor.sys

The latter three had been the result of running Microsoft Virtual Server in order to run a Windows 2003 instance on which to run SEPM, as it did not initially support Server 2008. Since MR4 supports Server 2008, I was able to remove the VM and install SEPM in the desired location. These three files were removed, but for some reason are still reported by the MS VSS to Backup Exec. The workaround (not a solution IMHO) of creating empty text files with the same name DID resolve that issue.

The VSS initialization failure is a separate issue. As it turns out, BE12.x doesn't react well to a Server 2008 machine running MS Virtual Server. Oh the irony. At the time, the only documentation available suggested to try a Windows Server backup to see if VSS was functioning properly. That worked fine, so I was left perplexed with what the problem/solution was. There was a support document attached to the error: V-79-10000-11219 but until recently it was not actually posted on the Symantec support site. It is now, and the cause? The GUID folder in the C:\windows\temp folder created by Windows backup. Oh the irony.

So I've deleted it and we'll see what happens.

[petenewk]

The comments here have been skirting the solution without really stating it very plainly. Hopefully this will resolve it for good.

Backup- System?State
VSS Snapshot warning. File c:\program files (x86)\symantec\symantec endpoint protection\smclu\setup\smcinst.exe is not present on the snapshot.

When you get a message like this, regardless of the file name, there is a reference to that file in the registry. My experience has usually been in the HKLM/System/Services folder, but I am sure there are other registry keys that the VSS client uses to determine what files are part of the system state. In my cases, the file has been the object of a service which is set to manual, and no longer runs on the machine. If you tried to start the service, it would report the file missing.

VSS reports the file as a file needed to restore the services for the System State, but it does not actually check to see if the file exists, hence the error when Backup Exec happily goes out to backup the file.

To solve the problem, search for the file name in the registry, determine why the file is missing. e.g. the software has been uninstalled but a key remains, or the file was deleted accidentally and the application needs to be repared. Once you have either removed the straggling registry entry or repaired and restored the missing files, your backup warnings should stop. 

[Absoblogginlute]

I had this problem the smcinst.exe and also c:\users\username\appdata\local\temp\lmi7ea2.tmp\lmi_rescue.exe
Both files do not exist (as they are both temporary/install files).
The lmi_rescue file does not appear anywhere in the registry.

In my case I just copied notepad.exe to the filename for logmeinrescueso that backupexec will stop giving me errors. 
What is more annoying is that I have removed the c:\users\username\appdata\local\temp from the backup selection list so it shouldn't even be trying to backup the data.

The symantec file referenced is the Symantec Auto-upgrade Agent which is normally set to manual. I'd have thought this should have a file there ready for when new updates are available?

I've removed the smclu\setup directory from the backup list to see what happens tonight.

[Absoblogginlute]

So I knew I had seen this error before, and sure enough I had!
Came across this issue again on a client site, googled it and came back here.
From what I can see at http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009081016003348?Open&seg=ent it's a known issue with liveupdate running and not clearing up after itself properly. Solution is to delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Smcinst subkey but it will reoccur when an autoupgrade occurs.

[Absoblogginlute]

Me again - had this issue happen again this weekend due to good old liveupdate.
We're now going to run the following on a weekly basis -
sc delete smcinst

Should fix it